hanshorst

<Rule name="RegOpenKey" id=1>
     <Argument>
        <Index>2</Index>
        <Action>EqualSubString</Action>
        <Data>"Run"</Data>
     </Argument>
</Rule>

<Rule name="CreateFile" id=2>
     <Argument>
        <Index>1</Index>
        <Action>PrintString</Action>
     </Argument>
</Rule>


<Ruleset id=1>
     <Group>Registry</Group>
     <Rule>1</Rule>
     <Op>AND</Op>
     <Rule>n</Rule>
     <Description>"Registry startup method (run/runonce)"</Description>
</Ruleset>

<Ruleset id=2>
     <Group>File access</Group>
     <Rule>2</Rule>
     <Description>"Accesses the following file:"</Description>
</Ruleset>